postgres/contrib/pg_tde/documentation/docs/global-key-provider-configuration/set-principal-key.md

# Global Principal Key Configuration

You can configure a default principal key using a global key provider. This key will be used by all databases that do not have their own encryption keys configured. The function **both** sets the principal key and rotates internal keys as needed.

## Create a default principal key

To create a global principal key, run:

```sql
SELECT pg_tde_create_key_using_global_key_provider(
    'key-name',
    'global_vault_provider'
);
```

## Configure a default principal key

To configure a global principal key, run:

```sql
SELECT pg_tde_set_default_key_using_global_key_provider(
    'key-name',
    'global_vault_provider'
);
```

## Parameter description

* `key-name` is the name under which the principal key is stored in the provider.
* `global_vault_provider` is the name of the global key provider you previously configured.

## How key generation works

The key material (actual cryptographic key) is auto-generated by `pg_tde` and stored securely by the configured provider.

!!! note
    This process sets the **default principal key for the entire server**. Any database without a key explicitly configured will fall back to this key.

## Example

This example is for testing purposes only. Replace the key name and provider name with your values:

```sql
SELECT pg_tde_create_key_using_global_key_provider(
    'test-db-master-key',
    'file-vault'
);

SELECT pg_tde_set_key_using_global_key_provider(
    'test-db-master-key',
    'file-vault'
);
```

## Next steps

[Validate Encryption with pg_tde :material-arrow-right:](../test.md){.md-button}